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Estimation of channel parameters is important for extending the range and increasing the key 
rate of continuous variable quantum key distribution protocols. We propose a new estimator for 
the channel noise parameter based on the method of moments. The method of moments finds an 
estimator from the moments of the output distribution of the protocol. This estimator has the 
advantage of being able to use all of the states shared between Alice and Bob. Other estimators 
are limited to a smaller publicly revealed subset of the states. The proposed estimator has a lower 
variance for high loss channel than what has previously been proposed. We show that the method 
of moments estimator increases the key rate by up to an order of magnitude at the maximum 
transmission of the protocol. 


I. INTRODUCTION 

Quantum Key Distribution (QKD) was proposed in 
1984 [1: as a solution to the key distribution problem. 
In this problem Alice wants to share a secret key with 
a remote party, Bob, but she only has public channels 
available to her. Alice can solve this problem by encod¬ 
ing the key into quantum states. Alice and Bob can then 
use quantum mechanics to prove their secret is uncondi¬ 
tionally secure from an eavesdropping adversary, Eve [2]. 
The key can then be used later from cryptographic pur¬ 
poses. Continuous Variable (CV) QKD uses the quadra¬ 
ture modulations and measurements of the phase and 
amplitude quadratures from a bright laser to distribute 
the shared secret [Ml- The coherent state protocol with 
homodyne detection |4j is commonly used for the study of 
CV QKD [6} d. In this protocol Alice sends Bob a series 
of randomly displaced vacuum states through an unse¬ 
cured channel. Bob then measures the received states by 
either switching between quadratures or measuring both 
simultaneously. Alice and Bob then estimate a bound 
on the maximum information that may have been inter¬ 
cepted by Eve in the channel. The optimal attack Eve 
can make on this protocol has been shown to be a Gaus¬ 
sian collective attack [8J. This attack assumes that Eve 
has access to all information lost in the channel. A bound 
on Eve’s information can be found as a function channel 
transmission, T, and excess channel noise relative to the 
input, £. In a practical CV QKD protocol these param¬ 
eters must be estimated from the shared secret between 
Alice and Bob. This ensures that the correct bound is 
found for the final secret key. This is currently done by 
Alice and Bob publicly revealing a random subset of their 
initial shared secret 00- The number of states revealed 
can be optimized to give an optimal key rate as discussed 
in Ref. [QUIT]. 

In this paper we build on some of the ideas presented 
in Ref. 0. The authors propose a way of estimating 
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the two parameters by modeling the protocol using as 
classical loss channel with additive Gaussian noise: 


Vi = tXi + Zi 


i = l,2,...N. 


(1) 


Here x, is the data sent by Alice, y* is Bob’s measurement 
data, Zi is a Gaussian noise term with variance er 2 = 
1 + Tt; and mean 0 and t = \/T. This model is well 
understood and a maximum likelihood estimator (MLE) 
exists for both the parameters t and cr 2 . The authors 
then use these estimators to find the worse case for excess 
noise transmission to find the final key rate. 

We propose to use the method of moments in conjunc¬ 
tion with the MLE for t to find an alternative estimator 
for a 2 . This estimator has a lower variance than the MLE 
as T —> 0. Generally this method produces estimators 
that are typically worse in terms of minimizing variance 
and bias than other estimation methods. However it has 
the advantage of only requiring the public exchange of 
moments rather than sacrificing part of the key for pa¬ 
rameter estimation. The estimator we use in this paper is 
a function of Alice and Bob’s variance and transmission 
estimates. The variances can be estimated and revealed 
by Alice and Bob individually using the whole shared se¬ 
cret. Estimation of the transmission still requires some of 
the shared secret to be revealed. Sharing the variance al¬ 
lows the estimator to use more of the accessible informa¬ 
tion to decrease the variance of the method of moments 
estimator, without sacrificing more of the shared 

secret. The variance of the estimator can be further im¬ 
proved by creating a linear combination of method of 
moments estimator and the MLE. The resulting estima¬ 
tor is the optimum of the two. 

This paper is organized as follows. Sec. [II] covers prior 
work on noise estimation and explains the coherent state 
CV QKD protocol in more detail. In Sec. |III| we explain 
the method of moments and show how we arrive at the 
two estimators. The variance of the method of moments 


estimators are then found and compared in Sec. IV to 
other CV QKD noise estimators and shown to be asymp¬ 
totically unbiased and in Sec. [V] we conclude the paper 
with a discussion of the method of moments estimator 
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and its effects on the final key rate. 


II. THE PROTOCOL AND MODEL 


estimators can then be written as, 

tin in »f - 2 £PE / 2 Std(f) (6) 

a max ~ ^MLE + 2 e p B / 2 Std(<7M L E) (?) 


In this paper we will consider the coherent state pro¬ 
tocol with homodyne detection |4j. In this protocol Alice 
prepares N displaced vacuum states, | q.i + ipi), through 
phase and amplitude quadrature modulation. The dis¬ 
placements qi and pi are both random variables sampled 
from the normal distribution A/"(0, Va). These states are 
transmitted to Bob through an unsecure channel with 
transmission T and excess noise £. The channel is as¬ 
sumed to be under the control of Eve. Bob will then 
measure the received states using a homodyne detec¬ 
tor switching randomly between the phase and ampli¬ 
tude quadratures. In reference to (JTj) we will take Xi as 
Alice’s modulations and yi as Bob’s measurement out¬ 
comes. When Alice uses modulation to prepare the states 
for Bob it is known as a prepare and measure protocol. 
These protocols have been shown to have an entangle¬ 
ment based equivalent pj] which is used for the security 
analysis m- 

Eves optimal attack with finite size effects has been 
shown to be a Gaussian attack [T4j. The collective state 
between Alice and Bob can be assumed to be Gaussian. 
For the entanglement based protocol it can be described 
by the covariance matrix 


Here Std is the standard deviation function and z epE / 2 = 
erf^ 1 (l — epe/ 2) where erf(x) is the error function. We 
can rewrite (|2|) for the worst case noise and transmission, 


r 


CPE 


(Va + 1 ) I 2 

bnin \/V A + 2VaC 2 


tmin\/V^ + 2 Va <Jz \ 

(^minV a + <4 ax ) hj 


( 8 ) 


Another proposed estimator from Ref. mu uses a second 
modulation transmitted with the key to assist the esti¬ 
mation of the channel parameters. This assumes the sec¬ 
ond modulation will experience the same channel as the 
modulation used for the final key. For the protocol ana¬ 
lyzed in their paper, Alice sends Bob squeezed displaced 
vacuum states with a squeezed quadrature variance of 
Vs- By setting Vs = 1 the protocol becomes the coher¬ 
ent state protocol. The parameters they estimate are the 
channel transmission T and the excess noise relative to 
the output Vj = T£. Thanks to the second modulation 
this estimator is able to use N states for the key and 
parameter estimation, 


t = 


\2~ 


{NV M2 


(9) 


( (Va + 1) I 2 

VT(V 2 + 2V A )a z \ 

(2) 


WT(V 2 + 2V A )a z 

(TV A + l + TS)hJ ’ 

i= 1 


TV a - 1, 


( 10 ) 


where cr z is the Pauli matrix 

= (o -l) ' (3) 

In a prepare and measure scheme Alice and Bob want 
to find the covariance matrix for the equivalent entan¬ 
glement based protocol. To do this they reveal a subset 
of 77i < N states for estimating the parameter t and er. 
Using the channel model Q for the protocol we have the 
maximum likelihood estimators j9): 


where xm 2 ,i is the displacement of the second modulation 
from Alice. These estimators were shown to be asymp¬ 
totically unbiased and to have the variances: 


Va I (r)=^( 2+f W), (11, 

Var(Vj) = + V A 2 Var(T), (12) 


where Vn = 1 + Vj + TVa and Vm 2 is the variance of 
the second modulation. The authors then suggests using 
the linear combination in Eq. (13) to find the optimal 
estimator T opt and V f opt at a high channel transmission. 


t = 


E ra 

i=i XiVi 

T m x 2 

2-ji =1 x i 


an d Omle = ~ E (Vi ~ ta») • (4) 

m z ' 

i= 1 


The distributions of these estimators are 


t ~ J\f (t 


1 x i 


and ^LE~ X 2 (m-l). (5) 


As described in Ref. jjj] the estimates are then used to 
find the worst case for t and er 2 . That is the minimum 
of t and the maximum of a 2 with in the confidence inter¬ 
val 1 — epE- The parameter ep E is the probability that 
the parameter estimation failed (Typically ep E = 10“ 10 ). 
Using the theoretical distributions in ([5]) the worst case 


d Q pt — oiOi + (1 — a)§2, (13) 


where (?i and 0 2 are two different estimators for either 
Vj or T. The optimum value of a to achieve a minimum 
variance from two independent estimators is given by, 


_ Var (0 2 ) 
Var(f?i) + Var (0 2 ) 


(14) 


This can be found by minimising Var(0 opt ) with respect 
to a. The variance of 9 opt is then given by, 


Var {0 0 pt) 


Var(0i)Var(d 2 ) 

Var () + Var(0* 2 ) 


(15) 
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By construction 9 op t will have a variance less than or 
equal to the variance of the estimators 9\ and 62 . The 
linear combination will also preserve the bias properties 
of the two estimators. 

Once the channel parameters are estimated Alice and 
Bob will select an appropriate reconciliation protocol and 
correct the remaining n = N — m states for errors. In 
this paper we will only consider reverse reconciliation j3] . 
Alice and Bob then hash their raw secret key to produce 
an information-theoretically secure final key [6]. 

The asymptotic key rate for the coherent state protocol 
with reverse reconciliation is bounded by [6: 

K > I(x : y) - S(y : E), (16) 

where I(x : y) is the mutual information between Alice 
and Bob and S(E : y) is the mutual information Eve has 
with Bob. Both of these terms can be calculated from 
the channel parameters. This bound can be rewritten to 
include the effects for reconciliation efficiency, /3, param¬ 
eter estimation, jj and epE on a finite key 0, 


III. THE METHOD OF MOMENTS 
ESTIMATOR 

The estimators in Eq. 0 are found by maximizing the 
log likelihood probability function \np(xi, yp,a 2 , t, Va). 
An alternative is to use the method of moments [TB] 
to find the estimators. The method of moments is a 
simple way to find an estimator but it has no optimal¬ 
ity properties. It performs best with a long data record 
which makes it suitable to CV QKD as typically the data 
record is > 10 8 [7j. To use the method we first find 
a probability distribution describing our observations in 
terms of the parameters we want to estimate. In the 
case of Bob’s measurements the distribution is given by 
Af(0,f 2 E A + cr 2 ). The moments of this distribution can 
then be solved as a system of equations for the param¬ 
eters we want to estimate. As Bob’s data is normally 
distributed around 0 the first moment will be zero and 
the second moment is given by the variance, 

al=t 2 V A + a 2 . (18) 
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K=-[fiI(x:y)-S epB (y:E)], (17) 

where S epE (y : E ) is calculated from the worst case es¬ 
timates of our channel parameters. The reconciliation 
efficiency, /3, is related to the amount of information Al¬ 
ice and Bob must sacrifice in order to perform this step. 
For a given transmission and noise of a channel the choice 
of reconciliation protocol can be optimized to maximize 

p sg. 


■ 10“ 2 



All other moments for this distribution will be a func¬ 
tion of (7g giving only one independent non zero moment. 
This allows us to only find one estimator. We are most 
interested in maximizing the keyrate for long distance CV 
QKD. The limiting factor for protocols with a high loss 
channel is the excess noise JS]- For this reason we willl 
concentrate on finding a better estimator for the output 
noise. The variance in Eq. ( fl8| ) can be used to estimate 
t but the process is made more difficult by requiring an 
estimate of a 2 . Starting with Eq. (18) and substituting 
the estimator for t and the sample variance for erg we find 
an initial estimator for the noise relative to the output. 


^mm — — tV A) (19) 

where is given by the sample variance jjYlVi- To 
use this estimator Alice and Bob can publicly reveal Va 
and <7g without giving away any more of the shared se¬ 
cret to Eve [5J. A decrease to the variance of <r^ m can 
be made by using the estimated second moment of Al¬ 
ice’s collective state, a\. The variances of of nrn and the 
new estimator are compared in appendix [A] This 

improvement comes from increasing the covariance be¬ 
tween cr| and t 2 a\ and is demonstrated by the following 
property of variance, 


Var(dB — t 2 a\) = Var(og) + Var (f 2 Va) 

- 2Cov(cri,f 2 VA)- (20) 


FIG. 1. (Color online) Plot of the standard deviation of 
the different noise estimators vs distance in a fiber channel: 

(dot dashed), (solid), CTmle (dot dot dashed), V^ opt 
(dotted) and (dashed) with simulations of Omm (circles) 
and dop t (squares). The parameters used were Va = 3, £ = 
0.01, m = 0.5x 10 5 , N = 10 5 , /3 = 0.95 and V 2 = 10. 


Substituting a a — j? x i we arrive at our final method 
of moments estimator, 


'MM 


_ ±.2 +2 A 2 

— <j b — t a A . 


( 21 ) 


Using Eq. (201 we can already see the improvement in the 


variance of the estimator a will have over d^ LE as the 
transmission approches zero for a fixed value of Va and 
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to. We find for both estimators their variance is given by 
the variance of the variance of Bob’s measurements, 

Var(<r|) = (22) 

where M is the number of samples used to find <r|. Tak¬ 
ing the varaince of both estimators we find Var((j^ M ) is 
better by a factor of ^. 

An interesting point is = ^mle when both esti¬ 

mators are used on the N transmitted states. Such as 
the case at the range limit of a protocol where we reveal 
almost all of the states for parameter estimation for a 
positive key. Using Q on the N transmitted states we 
find 


~ 2 

°MLE 


i= 1 

ixif 

(23) 

i N 

]vX>< - 

i—1 

i (e*Li 

(24) 

N Ef=r* 2 

-2 Pa 2 
a B &A 


(25) 

A 2 

a MM- 


(26) 


If in Eq. (23) we split the summation into the two sub¬ 
sets, the publically revealed to states and the secret n 
states, we can also show 


~ 2 

%M 


m i n 

= 2 + M 5Z (yi - ^i) 2 (27) 

(28) 




where is ^he method of moments estimator for the 

noise applied to the n states to be used to generate the 
final key. It is easy to show that (T^j LE and are 

independent estimators given t and <r^[ LE are also inde¬ 
pendent [5], This leads to the next estimator we present 
in this paper. As in Ref. m we can find an optimum 
linear combination of our two estimators. Using (13) we 
find an optimum estimate of the noise, 


^o P t — Q^mle + (1 _ ot)a 


MM" 


(29) 


Here a is given in Eq. (141. 


IV. PERFORMANCE 

For the purposes of CV QKD it is important to con¬ 
sider the variance and the bias of the parameter estima¬ 
tors. Finding an unbiased estimator with a minimized 
variance will ultimately lead to an increase in the key 
rate and secure distance of the protocol. 

For the method of moments estimators the variance and 
mean are difficult to find due to the division required for 
t. For this paper we use a standard method in uncertainty 



FIG. 2. (Color online) Plot of key rate with finite key effects 
relating to parameter estimation. The values Va and m have 
been optimized with £ = 0.01 to maximize key rate using 
°mle (dotted), <5mm (dot dashed) and <To P t (solid) to estimate 
the excess noise for (from left to right) N = 10°, N = 10', 
N = 10 9 and N = 10 12 . The asymptotic key rate with Va 
optimized is also plotted (black solid). 


analysis where the variance is approximated from a first 
order Taylor series expansion nu Given an estimator 0 
that is some function of J = { Ji(y), ■ ■ ■, Jr(y)}, 

where Ji(y ) is some statistic from the data vector y, we 
find the variance is approximated by, 


Var(0(J)) « ^ 


and the mean by 


E(6(J)) 


T de 

(30) 

Cj — 

J — fj, OJ J = /x 

« 6{n). 

(31) 


Here fi is the expected value of our statistics J and Cj is 
the covariance matrix for J. This method assumes that 
the statistics J will have a low variance and the estimator 
6 will be roughly linear around y. That is Eq. (301 and 
Eq. ( |31[ ) will be the asymptotic variance and mean. To 
apply this method we rewrite our estimators in terms of 
the data statistics, <7n, a\ , a 
<jj(jM becomes 


B> U A> W A'B' 


and o \,. The estimator 


~ 2 - 2 
%M = a B 


A'B' 


d-A 


(32) 


Here <r A / B / = m Xiyi is the covariance of the collective 
state shared by Alice and Bob. We use A' and B' to 
indicate the statistic was estimated from the to subset of 
states used for parameter estimation. The matrix C j can 
be found using the variance of the sample variance and 
the properties of the covariance and variance functions. 
The elements of Cj are given in appendix |B 1| Applying 
Eq. (30) the variance is given by 


Var(d^ M ) ~ -ft- + ~ n ) ^ 2 (j2 Va- 


(33) 
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FIG. 3. (Color online) The optimized values of ^ and Va 
for the key rates in Fig. [ 2 ] where N = 10® using <t£j LE (dot¬ 
ted), <5 m M (dot dashed) and cr 2 pt (solid) to estimate the excess 
noise. 


The final variance in ( |33| ) was achieved by making the 
substitution a a = a A' = Va, = t and Og = t 1 2 V a + 

a 2 4 . For the estimator we find a similar equation, 

Var(o-MM") ~ — + (— + “4“) 4t 2 (T 2 pA- (34) 

n \m a z n J 


As IM „ uses different statistics we will have a new Cj. 
This is given in appendix |B 2[ The variance of the opti¬ 
mal estimator is given by [10] 


y (~2 \ _ V ar ( cr MLE)^ rar ( q ’MM") 

opt Var(cr| ILE ) + Var(cr^ IM „) ‘ 


(35) 


The standard deviation of the estimators erj^ M and cr 2 ^ 
are plotted as a function of the channel distance in Fig.iT 
Finding the expected value our estimators using Eq. |3l] 
shows the estimator, is asymptotically unbiased. 
With a simulation of the coherent state protocol using 
N = 10 5 we show good agreement in Fig. [j]with Eq. ( [34| ) 
and Eq. (35). In practical demonstrations N has been of 
the order 10 8 to 10 9 l 7j. 


V. DISCUSSION AND CONCLUSION 


We have investigated using the method of moments 
in place of a maximum likelihood estimator to estimate 
the channel noise, a 2 for CV QKD protocols. We found 
the method of moments produced a similar estimator to 
the MLE for ct 2 . The method of moments estimator was 
found to have a lower variance with high loss channels. 
By combining the method of moments estimator with the 
MLE we showed that we could optimise the variance for 
any value of channel loss. The improvement in the vari¬ 
ance allows the protocol to use more of the shared secret 
for key generation. This is demonstrated in Fig[3] These 
estimators were shown to have a similar performance to 
the estimators proposed in Ref. cna- The advantage of 
the estimators proposed in our paper is they do not re¬ 
quire additional modulations and only use the states used 
for key generation and less for parameter estimation. 
The improvement in variance of <5 m M and <j 2 pt over the 
MLE comes from using more of the available information 
to Bob for estimation. This decrease in variance will lead 
to an increase in the key rate but not necessarily an in¬ 
crease in maximum distance as we show in Fig. [2] The 
reason for this comes back to Eq. ( f26| ). We show in Fig. [ 3 ] 
that as T —> 0 the optimal m goes to N which leads to 
both estimators approaching (Xmle- We note that our 
optimum estimator produces a key rate that is always 
greater than or equal to key rates found with the other 
estimators in Fig. [2] as expected. 

With simplicity of the method of moments this estima¬ 
tor can also be modified to be used with other CV QKD 
protocols such as the four state protocol [5] or to include 
more protocol parameters [13- 
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Appendix B: Elements of Cj 
1. Cj for <5 mm 

The diagonal terms for the covariance matrix Cj for 
the estimator ctmm are given by, 

. ,^ 2 \ 2cx A .„ 2 , 2 a\, 

Var(cr A = —, Var(cr A ,) = -, 

iv m 

?<r 4 1 

Var(crjl) = — f- and Var(d A / B ') = — (2f 2 cr A , + er 2 er A ,) 

iv m 

The off diagonal terms are given by, 

Cov(tt A , <x B ) = 2f 2 ^, Cov(d 2 ,d 2 ,) = 2 a -f, 

4 4 

Cov(<t a , tf A ' B ') = 2 1°^-, Co v(<j a ,,<t A / B ') = 2 1 — , 

J V m 

Cov(d 2 ,di,)=2t 2 ^ 


Appendix A: Variance of a„ 


Using the same method described in Sec. |IV| we find 
the variance for is given by 


and 


Cov(<f|, CTA'B') = 2f 


t 2 a\, + cr 2 cr A , 


N 


2. Cj for at 


The diagonal terms for the covariance matrix Cj for 
the estimator ctmm" are given by, 


Var(^J - W + T + {I ~ V ) < Al > 


Var (<f A „) = 


2<ri „ 


Var(di,) = 


2a\t 


?fT 4 1 

Var(<x|„) = B " and Var(<f A / B /) = —(2 t 2 a\, + cr 2 er A ,) 
n m 


Here the covariance Cj can be found using appen dix |B 1| 
and setting the appropriate values to 0. With Eq. |Al| we 
find 


Oy-4 T/ 2 

Var(d-^ m ) = —^4 + Var(d-^ M ). (A2) 


The off diagonal terms are given by, 


Cov(<j a „, = 2 1 2 


Cov(<j A //, <f A / B /) = 0, 
Cov((fg„, (j A /) = 0 and 


Cov(d A //, tf A /) = 0, 

4 

Cov(<f A /, <7 A ' B ') = 2 t—, 
m 

Cov((j|„,(fi, B ,) = 0. 


Here we use A" and B" to indicate the statistic was cal¬ 
culated using the n subset of states used for generating 
the final key. 


This agrees with our claim that Var(<f^ m ) > Var(tf^j M ). 










